Using a nonce with single sign-on

SAVE AS PDF

Using a nonce with single sign-on

You can implement a nonce to be used with single sign-on digest authentication. The
usage of a nonce prohibits a malicious user from performing a replay attack in order to log into
your system.

To use a nonce with the unencrypted token or encrypted token methods of single sign-on, these
steps apply with only a few minor changes.

Note: The nonce is used only for login
requests, not for any other type of request. If the system receives a nonce value after login,
the nonce is not consumed.

Nonce process flow

When a customer has implemented the digested token Single Sign-on and wishes to add the
security of a nonce, they follow a certain process flow.

A user logs into the customer's portal.

The customer generates the required SSO parameters and appends a random nonce to the end.
For example, if the customer were forwarding the authentication response via the query string,
it may look something like
this:

SM_USER=itil&DE_USER=V1QuWMmxSfBgfRS099X0cAjKo5Q=&NONCE=1407743018

The instance receives this request and retrieves the authentication variables. Before
attempting to verify the integrity of the authentication response, the instance checks the nonce
against an internal table (u_authentication_nonce) to verify that it does not yet exist. If the
nonce does not exist within that table, the nonce is then added to the table and the
authentication process is allowed to continue. However, if that nonce value already exists
within the table, the authentication attempt is cancelled and an error code of
failed_missing_requirement is returned, which typically takes the user back to
the login page.